Django CMS up to 5.0.8 Page Duplication cms/admin/forms.py AddPageForm.clean Source privileges management

Summaryinfo

A vulnerability categorized as problematic has been discovered in Django CMS up to 5.0.8. The affected element is the function AddPageForm.clean of the file cms/admin/forms.py of the component Page Duplication. The manipulation of the argument Source results in privileges management. This vulnerability was named CVE-2026-63003. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in Django CMS up to 5.0.8. It has been classified as problematic. Affected is the function AddPageForm.clean of the file cms/admin/forms.py of the component Page Duplication. The manipulation of the argument source with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality. CVE summarizes:

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts any Page, the AddPageForm constructor does not narrow a hidden source field, AddPageForm.clean does not validate the source against the user, and AddPageForm.save calls from_source. In cms/admin/pageadmin.py, duplicate and PageAdmin.has_add_permission check only whether a staff user may add a page. A crafted source value can therefore copy every placeholder and plugin from an unauthorized page with permissions=False, stripping source view restrictions and exposing content across sites or restricted subtrees when CMS_PERMISSION is enabled. This issue is fixed in versions 5.0.9.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-63003 since 07/15/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 08/20/2026). The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 5.0.9 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-63570). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Content Management System

Name

• Django CMS

Version

• 5.0.0
• 5.0.1
• 5.0.2
• 5.0.3
• 5.0.4
• 5.0.5
• 5.0.6
• 5.0.7
• 5.0.8

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion